“[T]here’s an urgent question about the records, fundamental to understanding not just the fate of the data for IDNYC [New York municipal identification card], but all consumer data in the hands of third parties, be they private companies or state departments: Can an entire dataset of important information really be deleted, just like that?”